CRA-ASSESSMENT.md
April 21, 2026 · View on GitHub
🛡️ Hack23 Homepage — CRA Conformity Assessment
Evidence-Driven Conformity Through Systematic Assessment
EU Cyber Resilience Act Compliance for Corporate Website
📋 Document Owner: CEO | 📄 Version: 1.1 | 📅 Last Updated: 2026-04-21 (UTC)
🔄 Review Cycle: Quarterly | ⏰ Next Review: 2026-07-21
🏷️ Classification: 
🎯 Purpose Statement
This CRA conformity assessment documents how the Hack23 Homepage (hack23.com) addresses EU Cyber Resilience Act requirements through systematic self-assessment. As a static HTML/CSS website with no server-side code, backend database, or user data processing, the homepage has a minimal attack surface and low CRA risk profile.
As a cybersecurity consulting company, Hack23 AB applies the same rigorous assessment methodology to its own corporate website, demonstrating the security-first approach that clients can expect from our consulting services.
— James Pether Sörling, CEO/Founder
📚 Related Architecture Documentation
| Document | Focus | Description |
|---|---|---|
| 🏛️ Architecture | C4 Model | System structure and deployment |
| 🛡️ Security Architecture | Security | Defense-in-depth security controls |
| 🎯 Threat Model | Threats | STRIDE/MITRE ATT&CK threat analysis |
| 📊 Data Model | Data | Content model and data structures |
| 🔄 Flowchart | Processes | CI/CD and content workflows |
| 📈 State Diagram | States | Deployment and content lifecycle |
| 🧠 Mindmap | Concepts | System conceptual relationships |
| 💼 SWOT | Strategy | Strategic analysis |
| 🔄 Workflows | CI/CD | GitHub Actions workflow documentation (10 workflows) |
| 🔄 BCP Plan | Resilience | Business continuity & recovery |
| 💰 Financial & Security Plan | Cost | TCO & security investment |
| 🔚 End-of-Life Strategy | Lifecycle | Technology lifecycle management |
| 🏷️ Classification | Data | Security classification framework |
📚 Reference Implementations
The following Hack23 AB projects demonstrate completed CRA assessments:
| 🚀 Project | 📦 Product Type | 🏷️ CRA Classification | 📋 Assessment Status | 🔗 Reference Link |
|---|---|---|---|---|
| 🕵️ CIA (Citizen Intelligence Agency) | Political transparency platform | Standard (Non-commercial OSS) | ✅ Complete | 📄 CRA Assessment |
| ⚫ Black Trigram | Korean martial arts game | Standard (Non-commercial OSS) | ✅ Complete | 📄 CRA Assessment |
| 🛡️ CIA Compliance Manager | Compliance automation tool | Standard (Non-commercial OSS) | ✅ Complete | 📄 CRA Assessment |
| 🌐 Hack23 Homepage | Corporate website | Standard (Non-commercial OSS) | ✅ Complete | This document |
1️⃣ Project Identification
Supports CRA Annex V § 1 - Product Description Requirements
| Field | Value |
|---|---|
| 📦 Product | Hack23 Homepage (hack23.com) |
| 🏷️ Version | Continuous deployment from main branch |
| 🔗 Repository | https://github.com/Hack23/homepage |
| 📧 Security Contact | security@hack23.org |
| 🎯 Purpose | Corporate website (1,353 HTML files = 105 English source pages localised across 14 languages) showcasing Hack23 AB's cybersecurity consulting services, 7 open-source projects, and the public ISMS portfolio (transparency-by-design) |
📋 Evidence Links:
- 🏗️ System Architecture: ARCHITECTURE.md — Complete C4 model architecture
- 🔐 Security Architecture: SECURITY_ARCHITECTURE.md — Defense-in-depth security implementation
- 🛡️ Future Security Vision: FUTURE_SECURITY_ARCHITECTURE.md — Security enhancement roadmap
- 🎯 Threat Model: THREAT_MODEL.md — STRIDE/MITRE ATT&CK threat analysis
- 📊 Data Architecture: DATA_MODEL.md — Content model and data structures
- 🔄 Process Workflows: FLOWCHART.md — CI/CD and content workflows
- 🔧 CI/CD Workflows: WORKFLOWS.md — GitHub Actions pipeline documentation
- 🧠 System Overview: MINDMAP.md — Conceptual system relationships
- 🎯 Strategic Analysis: SWOT.md — Strategic assessment
📊 Project Status & Quality Badges:
2️⃣ CRA Scope & Classification
Supports CRA Article 6 - Scope and Article 7 - Product Classification Assessment
🏢 CRA Applicability:
🌐 Distribution Method:
📋 CRA Classification:
📝 CRA Scope Justification: The Hack23 Homepage is a static HTML/CSS website with no server-side code execution, no database, no user authentication, and no personal data processing. It serves purely informational content via AWS S3 + CloudFront CDN. As non-commercial open-source software distributed via GitHub under Apache 2.0 license, it falls under non-commercial OSS with Standard CRA classification enabling self-assessment approach.
📋 Classification Evidence:
- 📜 Open Source License: Apache 2.0 License
- 🏛️ Classification Framework: ISMS Classification Policy
- 📊 Public Repository: GitHub Repository
🔍 Minimal Attack Surface:
- No server-side code execution (static HTML/CSS only)
- No user input processing (no forms, no JavaScript input handling)
- No authentication or session management
- No database or data persistence
- No API endpoints
- Content served read-only via CDN
3️⃣ Technical Documentation
Supports CRA Annex V § 2 - Technical Documentation Requirements
| 🏗️ CRA Technical Area | 📝 Implementation Summary | 📋 Evidence Location |
|---|---|---|
| 🎨 Product Architecture (Annex V § 2.1) | Static HTML5/CSS3 website deployed on AWS S3 + CloudFront CDN with C4 architecture documentation | ARCHITECTURE.md + SECURITY_ARCHITECTURE.md + MINDMAP.md |
| 📦 SBOM & Components (Annex I § 1.1) | Minimal dependencies (static HTML/CSS, Node.js build tools for minification). SLSA Level 3 build attestations for releases | GitHub Attestations + Latest Release |
| 🔐 Cybersecurity Controls (Annex I § 1.2) | No server-side code; security via AWS CloudFront (TLS 1.3, security headers, DDoS protection), GitHub Actions hardening (StepSecurity), supply chain security (OpenSSF Scorecard) | SECURITY_ARCHITECTURE.md + THREAT_MODEL.md |
| 🛡️ Supply Chain Security (Annex I § 1.3) | SLSA Level 3 attestations, Dependabot automation, OpenSSF Scorecard monitoring, SHA-pinned GitHub Actions | WORKFLOWS.md + OpenSSF Scorecard |
| 🔄 Update Mechanism (Annex I § 1.4) | Continuous deployment via GitHub Actions with automated security scanning (CodeQL, dependency review), OWASP ZAP full scan post-deployment | WORKFLOWS.md + FLOWCHART.md |
| 📊 Security Monitoring (Annex I § 1.5) | OpenSSF Scorecard supply chain monitoring, GitHub Security Advisories, Dependabot alerts, OWASP ZAP scheduled scans, CloudFront access logging | SECURITY_ARCHITECTURE.md |
| 🏷️ Data Protection (Annex I § 2.1) | No personal data processed. Static content only. AWS S3 AES-256 encryption at rest, TLS 1.3 in transit. Data classification per ISMS framework | DATA_MODEL.md + CLASSIFICATION.md |
| 📚 User Guidance (Annex I § 2.2) | Comprehensive README, architecture documentation, security architecture, threat model, and ISMS policy references | README.md + SECURITY_ARCHITECTURE.md |
| 🔍 Vulnerability Disclosure (Annex I § 2.3) | Public vulnerability disclosure policy via GitHub Security Advisories with coordinated disclosure process | SECURITY.md + Vulnerability Management Policy |
📋 ISMS Integration:
- 🏗️ Architecture & Design: ARCHITECTURE.md + SECURITY_ARCHITECTURE.md + FUTURE_ARCHITECTURE.md + FUTURE_SECURITY_ARCHITECTURE.md
- 🔒 Security Controls: Information Security Policy + Network Security Policy
- 🔧 Development Process: Secure Development Policy + WORKFLOWS.md
4️⃣ Risk Assessment
Supports CRA Annex V § 3 - Risk Assessment Documentation
Reference: 📊 Risk Assessment Methodology and ⚠️ Risk Register
| 🚨 CRA Risk Category | 🎯 Asset | 📊 Likelihood | 💥 Impact (C/I/A) | 🛡️ CRA Control Implementation | ⚖️ Residual | 📋 Evidence |
|---|---|---|---|---|---|---|
| Supply Chain Attack (Art. 11) | Build pipeline & npm dependencies | L | M/M/L | SLSA Level 3, Dependabot, OpenSSF Scorecard, SHA-pinned actions, StepSecurity harden-runner | VL | WORKFLOWS.md + Scorecard |
| Content Tampering (Art. 11) | HTML/CSS website content | L | L/M/L | S3 versioning, CloudFront origin access, branch protection, PR reviews, CI validation | VL | SECURITY_ARCHITECTURE.md |
| CDN/Infrastructure Attack (Art. 11) | AWS CloudFront/S3 | VL | L/L/M | AWS managed security, TLS 1.3, DDoS protection (Shield Standard), security headers | VL | SECURITY_ARCHITECTURE.md |
| CI/CD Pipeline Compromise (Art. 11) | GitHub Actions workflows | L | L/M/L | Least-privilege OIDC, hardened runners, pinned actions, branch protection rules | VL | WORKFLOWS.md |
| Website Defacement (Art. 11) | Public website content | L | L/M/L | S3 bucket policy (no public write), CloudFront OAI, Git-based content control, automated backups | VL | SECURITY_ARCHITECTURE.md |
📊 Risk Assessment Summary:
- Overall Risk Level:
- Primary Justification: Static website with no server-side code, no user data processing, no authentication, served via managed AWS infrastructure with comprehensive supply chain security controls
5️⃣ Essential Cybersecurity Requirements
Supports CRA Annex I - Essential Cybersecurity Requirements Assessment
Annex I Part I — Security Properties
| # | Requirement | Applicability | Implementation | Status |
|---|---|---|---|---|
| 1.1 | Products designed without known exploitable vulnerabilities | ✅ Applicable | Static HTML/CSS only; CodeQL SAST, OWASP ZAP DAST scanning; Dependabot SCA |  |
| 1.2 | Secure default configuration | ✅ Applicable | No configuration required by users; secure defaults in AWS CloudFront (TLS 1.3, security headers) | |
| 1.3 | Protection against unauthorized access | ⚠️ Limited | No user authentication needed; AWS IAM with OIDC for deployment; S3 bucket policy prevents unauthorized writes | |
| 1.4 | Protect confidentiality of data | ⚠️ Limited | All content is public by design; no confidential data stored; TLS 1.3 in transit, AES-256 at rest | |
| 1.5 | Protect integrity of data | ✅ Applicable | Git version control, S3 versioning, CloudFront origin access identity, CI validation pipeline | |
| 1.6 | Minimize data processing | ✅ Applicable | No personal data collected or processed; privacy-first design with no analytics tracking | |
| 1.7 | Protect availability | ✅ Applicable | CloudFront CDN with 400+ edge locations; Route53 health checks; GitHub Pages DR fallback | |
| 1.8 | Minimize negative impact on other services | ✅ Applicable | Static website cannot affect other services; no outbound connections; no API calls from served content | |
Annex I Part II — Vulnerability Handling
| # | Requirement | Implementation | Status |
|---|---|---|---|
| 2.1 | Identify and document vulnerabilities | CodeQL SAST, OWASP ZAP DAST, Dependabot SCA, OpenSSF Scorecard supply chain analysis | |
| 2.2 | Address vulnerabilities without delay | Dependabot auto-PRs for dependency updates; vulnerability SLAs per Vulnerability Management Policy | |
| 2.3 | Apply effective testing | CI pipeline with HTMLHint, HTML5 validator, Linkinator, Lighthouse audits; OWASP ZAP full scan post-deployment | |
| 2.4 | Disclose vulnerabilities | SECURITY.md with GitHub Security Advisories; coordinated disclosure via security@hack23.org | |
| 2.5 | Provide security updates | Continuous deployment via GitHub Actions; automated dependency updates; SLSA Level 3 attestation for releases | |
6️⃣ Security Testing Evidence
Supports CRA Annex V § 4 - Testing and Verification Documentation
Automated Security Testing Pipeline
| Test Type | Tool | Schedule | Scope | Evidence |
|---|---|---|---|---|
| SAST | CodeQL | PR + Push | HTML, JavaScript analysis | Code Scanning |
| DAST | OWASP ZAP Full Scan | Post-deployment | Live website https://hack23.com | ZAP Workflow |
| SCA | Dependabot | Continuous | npm dependencies | Dependabot Alerts |
| Supply Chain | OpenSSF Scorecard | Weekly | Repository security posture | Scorecard Results |
| Quality | HTMLHint + HTML5 Validator | PR + Push | All HTML files | PR Workflow |
| Links | Linkinator | PR + Push | All internal and external links | Quality Checks |
| Performance | Lighthouse CI | Post-deployment | Performance, Accessibility, SEO | Deploy Workflow |
| Accessibility | Lighthouse (WCAG 2.1 AA) | Post-deployment | All pages audited | Target: Score 100 |
Build Attestation & Provenance
| Attestation Type | Tool | Level | Verification |
|---|---|---|---|
| Build Provenance | GitHub Attestations | SLSA Level 3 | gh attestation verify |
| Release Attestation | actions/attest-build-provenance | SLSA Level 3 | Signed build provenance |
Verification Command:
gh attestation verify <release-asset> --owner Hack23
7️⃣ Conformity Assessment Conclusion
Assessment Summary
| Dimension | Assessment | Rationale |
|---|---|---|
| Product Type | Static HTML/CSS website | No server-side execution, no user data processing |
| CRA Classification | Standard (Non-commercial OSS) | Self-assessment approach sufficient |
| Overall Risk | Very Low | Minimal attack surface, read-only content delivery |
| Compliance Status | ✅ Conformant | All applicable CRA requirements addressed |
Key Differentiators
- Minimal Attack Surface: Static website with no server-side code eliminates entire categories of vulnerabilities (injection, authentication bypass, session hijacking)
- Defense in Depth: Despite minimal risk, comprehensive security controls are applied (AWS CloudFront, TLS 1.3, security headers, supply chain security)
- Transparency: Full security architecture, threat model, and CRA assessment published as open-source documentation
- Automated Security: Continuous security scanning (CodeQL, ZAP, Scorecard, Dependabot) with automated remediation
- ISMS Integration: Aligned with ISO 27001, NIST CSF 2.0, CIS Controls v8.1 through Hack23 ISMS
Conformity Declaration
This self-assessment confirms that the Hack23 Homepage meets applicable EU Cyber Resilience Act requirements for a Standard-classified non-commercial open-source software product. The static nature of the website, combined with comprehensive security controls and continuous monitoring, ensures a robust security posture with very low residual risk.
📋 ISMS Policy Alignment
| ISMS Policy | Relevance | Implementation |
|---|---|---|
| Secure Development Policy | CI/CD security, code review | Branch protection, automated scanning, PR reviews |
| Vulnerability Management | Vulnerability handling | Dependabot, CodeQL, ZAP, defined SLAs |
| Network Security Policy | CDN and TLS configuration | CloudFront TLS 1.3, security headers |
| Cryptography Policy | Encryption standards | AES-256 at rest, TLS 1.3 in transit |
| Access Control Policy | Deployment access | AWS OIDC, GitHub branch protection |
| Incident Response Plan | Security incident handling | Defined procedures, contact channels |
| Backup & Recovery Policy | DR strategy | S3 versioning, GitHub Pages fallback |
| Risk Register | Risk tracking | Integrated with threat model |
| Compliance Checklist | Multi-framework compliance | ISO 27001, NIST CSF, CIS Controls |